mirror of
https://github.com/n8n-io/n8n.git
synced 2026-08-30 18:01:23 +08:00
Charlie Kolb
105 lines
3.9 KiB
YAML
105 lines
3.9 KiB
YAML
# n8n stack definition for get-n8n.sh (https://get.n8n.io).
|
|
# Downloaded at install time; the copy in your install directory is yours to
|
|
# edit and the script never rewrites it. To review changes between versions:
|
|
# https://github.com/n8n-io/n8n/commits/master/docker/get-n8n-compose.yml
|
|
# compose-version: 1
|
|
|
|
volumes:
|
|
n8n-data:
|
|
sandbox-tls:
|
|
|
|
services:
|
|
sandbox-certs:
|
|
image: ghcr.io/n8n-io/n8n-sandbox-service-api:latest
|
|
user: '0:0'
|
|
entrypoint: ['sh', '-c']
|
|
command:
|
|
- >
|
|
bootstrap-mtls.sh --out-dir /tls --api-san sandbox-api
|
|
--control-san-prefix sandbox-runner --world-readable &&
|
|
chown -R sandbox-api:sandbox-api /tls/api && chmod -R a+rX /tls
|
|
environment:
|
|
NUM_RUNNERS: '1'
|
|
volumes:
|
|
- sandbox-tls:/tls
|
|
|
|
sandbox-api:
|
|
image: ghcr.io/n8n-io/n8n-sandbox-service-api:latest
|
|
depends_on:
|
|
sandbox-certs:
|
|
condition: service_completed_successfully
|
|
env_file: .env
|
|
environment:
|
|
SANDBOX_API_GRPC_TLS_CERT_FILE: /tls/api/grpc-server.crt
|
|
SANDBOX_API_GRPC_TLS_KEY_FILE: /tls/api/grpc-server.key
|
|
SANDBOX_API_GRPC_TLS_CLIENT_CA_FILE: /tls/api/ca.crt
|
|
SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_CA_FILE: /tls/api/ca.crt
|
|
SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_CERT_FILE: /tls/api/control-grpc-api-client.crt
|
|
SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_KEY_FILE: /tls/api/control-grpc-api-client.key
|
|
SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_SERVER_NAME: sandbox-runner-1
|
|
volumes:
|
|
- sandbox-tls:/tls:ro
|
|
healthcheck:
|
|
test: ['CMD', 'wget', '-qO-', 'http://localhost:8080/healthz']
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 5
|
|
start_period: 10s
|
|
# Never publish 8080/9090 to the host on an internet-facing server.
|
|
# n8n reaches this container by service name, over the default Compose network.
|
|
|
|
sandbox-runner-1:
|
|
image: ghcr.io/n8n-io/n8n-sandbox-service-runner-dind:latest
|
|
privileged: true
|
|
depends_on:
|
|
sandbox-api:
|
|
condition: service_healthy
|
|
env_file: .env
|
|
environment:
|
|
SANDBOX_RUNNER_API_GRPC_ADDR: sandbox-api:9090
|
|
SANDBOX_RUNNER_HTTP_BASE_URL: http://sandbox-runner-1:8080
|
|
SANDBOX_RUNNER_CONTROL_GRPC_LISTEN_ADDR: ':9091'
|
|
SANDBOX_RUNNER_CONTROL_GRPC_ADVERTISE_ADDR: sandbox-runner-1:9091
|
|
SANDBOX_RUNNER_ID: runner-1
|
|
SANDBOX_RUNNER_DOCKER_SANDBOX_IMAGE: ghcr.io/n8n-io/n8n-sandbox-service-sandbox:latest
|
|
SANDBOX_RUNNER_REGISTRATION_GRPC_CA_FILE: /tls/runner/ca.crt
|
|
SANDBOX_RUNNER_REGISTRATION_GRPC_CERT_FILE: /tls/runner/grpc-client.crt
|
|
SANDBOX_RUNNER_REGISTRATION_GRPC_KEY_FILE: /tls/runner/grpc-client.key
|
|
SANDBOX_RUNNER_REGISTRATION_GRPC_SERVER_NAME: sandbox-api
|
|
SANDBOX_RUNNER_CONTROL_GRPC_TLS_CERT_FILE: /tls/runner/control-grpc-server.crt
|
|
SANDBOX_RUNNER_CONTROL_GRPC_TLS_KEY_FILE: /tls/runner/control-grpc-server.key
|
|
SANDBOX_RUNNER_CONTROL_GRPC_TLS_CLIENT_CA_FILE: /tls/runner/ca.crt
|
|
volumes:
|
|
- sandbox-tls:/tls:ro
|
|
# Never expose this container's ports publicly — it runs privileged Docker-in-Docker.
|
|
|
|
n8n:
|
|
image: docker.io/n8nio/n8n:${N8N_VERSION}
|
|
depends_on:
|
|
sandbox-api:
|
|
condition: service_healthy
|
|
ports:
|
|
- '5678:5678' # the only port that should be internet-facing
|
|
env_file: .env
|
|
volumes:
|
|
- n8n-data:/home/node/.n8n
|
|
|
|
runners:
|
|
image: ghcr.io/n8n-io/runners:${N8N_VERSION}
|
|
depends_on:
|
|
- n8n
|
|
environment:
|
|
N8N_RUNNERS_AUTH_TOKEN: ${N8N_RUNNERS_AUTH_TOKEN}
|
|
N8N_RUNNERS_TASK_BROKER_URI: http://n8n:5679
|
|
# Idle runners exit and are relaunched on demand (per the task-runners docs)
|
|
N8N_RUNNERS_AUTO_SHUTDOWN_TIMEOUT: '15'
|
|
# Runs user code from Code nodes. Never publish this container's ports.
|
|
|
|
searxng:
|
|
image: ghcr.io/searxng/searxng:latest
|
|
environment:
|
|
SEARXNG_SECRET: ${SEARXNG_SECRET}
|
|
volumes:
|
|
- ./searxng-settings.yml:/etc/searxng/settings.yml:ro
|
|
# Internal-only: n8n reaches it by service name. Never publish its port.
|